We use RestHeart which comes with an AGPL license. We are looking for a clue whether how this license should be applied.

Situation: We have a REST service on server 1. This REST Service consumes the RestHeart REST server on another service which also runs MongoDB. So, we do not link the software directly, nor do we change it. RestHeart runs as a standalone Java program on another server. We do communicate with RestHeart over a HTTP connection.

So, the question is, do we need to make our own REST service AGPL too? or not?

edit
This is the current architecture, flow.

User/Customer on web page calls a REST service on Server 1. Server 1 contains all our own code.
On server 1, the REST call is passed on to RestHeart which resides on server 2 and includes MongoDB. Restheart is started as a standalone tool via Java.
All servers run in a contained environment, meaning these are Virtual Machines on a server enclosure.
Customers/Users do not directly interact with RestHeart but always via our own code on server 1.

1 Answer
1

The AGPL does not require that you make other software available under the AGPL as well. The AGPL is essentially the GPL with the following additional requirement:

"if you modify the Program, your modified version must prominently
offer all users interacting with it remotely through a computer
network (if your version supports such interaction) an opportunity to
receive the Corresponding Source of your version by providing access
to the Corresponding Source from a network server at no charge,
through some standard or customary means of facilitating copying of
software."

The technical details of how you set up your network communication does not affect how the AGPL license applies. Based on your description here is my understanding of the way a user would use your program:

Although you have placed several "hops" in between the user and the AGPL program, a user still can interact with it remotely through a computer network, so you are still obligated to consider the AGPL requirement of the AGPL program you are using and making available. Specifically, if you later decide to modify the AGPL program and continue to offer it for remote use over a network, you need to provide your users a way to obtain the corresponding source of your version.

Regarding extra network hops, I assume this depends on whether a hop just forwards the connection or whether this hop is a service that itself is the user of the AGPL'ed software. E.g. a typical webapp that uses an AGPL'ed database: the webapp's provider is a user of the database. The users of the app are just users of the app, they don't interact with the database in any meaningful way. However, that is just my personal theory.
– amonOct 16 '18 at 9:10